Endpoint Protection

I am having a problem with gotoassist on our network. It works fine with any machine with SEP that does not have the network protection part installed but it will not run on any machine that has the network protection part installed.

It will error out with a error 0xc000008 when trying to manually install the gotoassist client.

I have looked through the logs and do not see anything about it being blocked.

If i disable the SEP client I am still not able to run gotoassist, however as soon as i uninstall SEP I am able to run the gotoassist just fine.

I have not made many changes from the default set of polices,  the ones that I have made have all been minor ones.

I have already set it to only log remote access software and modified the part of the firewall policy that tells it to block all other traffic and set it to allow instead. Application and Device control is installed but not set to block anything right now.

If anyone else has had this problem and resolved it already I would appreciate any help you could provide.

 Open Registry go to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysPlant
on the right pane change the value of Start to 4
Reboot your computer and check if GotoAssist is working.

Application and Device Control sometimes blocks applications even without any rule applied and till Network Threat Protection is not installed it does not work.

Try the above step or try removing just Application and Device control from Add/Remove -- Change/Modify.

U can create a rule in firewall and allow the port/services.

Removing Application and Device control did solve the issue for me to be able to run the program. So that does seem to be what is causing the issue.

However I would like to have this feature enabled on the clients to prevent unwanted programs from being installed or ran, so I would like to know a way to get it to stop blocking this program.

I have tried adding the program to the section for not applying the condition the following processes and also created a new condition that said to allow that program to run. However I am still not able to run the program.

I don't like the idea of the feature blocking random programs without any log of doing so and without a way to turn off blocking of those programs other than turning off the feature completely.

have you created any centralized exception for gotoassist progaram?
click on centralized exceptions
click on edit
click on add, then select truscan proactive scan - select detected process..
do u see any gotoassist processes getting blocked? if so add them to exception
update the policy and check.

 Well there has been many programs that were blocked with App Control however Symantec Dev. Team has fixed it in later releases.
I would suggest you to call Symantec and open a case for this.So that they can take up this issue if required to Dev. team.

I have tried that and it didn't seem to matter if the program was listed under exceptions or not.

As I said before I do not see it listed in any list as being blocked or anything.

 Do you have any Policy for Application control.checked/enabled Specially "Block Applications from Running".

If yes then try withdrawing the app control policy to see if it works.

having the same problem here, only to find out SEP version 11.0.4202.75 works fine with gotoassist, but the new version 11.0.5002.333 not.

Did someone open a ticket yet???

When I run the exe nothing happens. It appears like it is blocked. I had GoToAssist support trying to help me and they told me SEP appears to be blocking me from installing GoToAssist.

My operating system is Windows 7 -32 bit. I uninstalled Application and Device control as mentioned above and verified registry settings (they were already set as the previous post describes). This was all done when logged on as Administrator.

I have SEP version 11.0.5002.333.

I second the call for someone to open a ticket with symantec. I would have done that myself but don't how.

Here is the page where the appropriate phone numbers can be found http://www.symantec.com/business/support/contact_techsupp_static.jsp. You will get a support ID number after talking with support. You should post this id number here in the forums so symantec employees and technical support can easily look up the status of your case. If you have any troubles feel free to post again or PM me directly.

Thanks,
Grant

I have now opened a ticket. The case ID is: 281-890-013

The case (number 281-890-013) which I had opened with Symantec is now closed. I uninstalled SEP and it still doesn't work. So my conclusion is that it is not Symantec that is blocking it but another program or setting on my system.

I am suspicious it could be Visual Studio 2005 or SQL Server Express 2005 because they install .NET framework componants during installation. We are going to test this on another system (with Windows 7) and install only one thing at a time and see if we can't locate the problem.

By the way, we did install GoToAssist on yet another Windows 7 system (a computer without Visual Studio 2005 or SQL Server Express 2005) and it worked. That is part of the reason for my conclusion that these programs might have something to do with my problem.

Thanks,
IT2428

Thanks for coming back and letting us know : )

Grant-

I'm going to open another call with Symantec about this but GotoAssist stopped working once we upgraded to MR5.  Uninstalling the SEP client makes it work again, I havent managed to find any settings in the Application control that allow it to work

My call ref 410642654

G'day,

We're experiencing the same issue.  We upgraded our SEPM server from 11 MR4 MP4 to 11.0.5 and then deployed clients out over the network throught SEPM.  After this we started experiencing this issue as described above.  I have tried the suggestions above and none have worked, as well as trying to add the complete list of GotToAssist executables to the centralized exclusions list:

gotoassist_chat2way_service_570_en.exe
G2AInstaller.exe
g2aservice.exe
g2acomm.exe
g2alaunchercustomer.exe
g2auicustomer.exe
g2asessioncontrol.exe
g2achat.exe
g2aremotediagnostics.exe
g2afiletransfer.exe
g2aremote.exe

This did not work either.  Any other ideas???

I've got this logged with Symantec support and there is an issue.  The only way to get it to work is to modify the install of SEP and remove the 'Application And Device Control' part.

It doesnt matter how you set it up, I've tried setting policy exactly as you have and also set policy to not even use App control.  Simply having that part installed stops Goto Assist working.  It doesnt seem to be that it is trying to block that app as there are no logs or anything generated.  It just breaks it by being there.  I will post any more info here as the support call develops.

A

If that is the case, is there a way to disable "application and device control" via policy?  I dont particulary feel like going around to 2000+ systems and re-installing :P

From the forum community's description, this looks like a known image base/ADC issue, though the pop-up error code looks a little different.  (Details are in the following article:  After migrating a Symantec Endpoint Protection (SEP) 11 client to Release Update (RU) 5 or installing RU5, applications fail to initialize properly with a 0xc0000005 error.)  The changes made in the forthcoming release of SEP are expected to resolve those ADC issues.

I examined a copy of GoToAssist myself (GoToAssist Express 1.3.0.209, GoToAssist ExpressCustomer Downloader 1.3.0.209) but did not encounter any errors.  I gather that this issue only affects SEP 11 RU5 with ADC and certain versions fo GoToAssist.  I'll continue to monitor this thread.

Thanks and best regards,

Mick

Adam,
I'm afraid not, if you disable App and device control in policy it still breaks it.  It has to be actually uninstalled.  The only solution I could suggest is to create a new install package and push it out with SMS or the Symentec push tool (on the 2nd CD but I cant remember what they call it) 

Mick,
I agree, we only started having the issue when we upgraded to the latest version 11.0.5002.333.  Our suppliers who use GotoAssist both use the corporate version, not express but I dont know if they are up to date or not.  We wouldnt go back with our SEP client as we were having major issues with the previous version bluescreening our desktops.  Do we have an idea of when the next MR is due - I guess Symantec are hurrying that at least to fix the 2010 definitions problem?

Has this issue been solved?  I am having this issue but haven't found a way to fix it.  Since the software doesn't install there is no log of the program or process trying to run on the SEPM.

Removing App and Device Control is not a solution in our environment.

I have just this morning received a mail from Symantec saying they're going to send me 2 replacement files (sysfer.dll and sysplant.sys) which they hope will fix it.  I'll let you know the result as soon as I get them, hopefully later today.
If they dont mind I can forward them on to you later

Andy

Symantec sent me a new version of sysfer.dll and sysplant.sys (11.0.5005.304) which seem to have fixed the issue.  I don't know how long until they officially release these but if anyone wants a copy let me know here and I can email them over.

For the record the case number was 410-642-654

Andy

Excellent, Andy!  Glad to hear that those test files worked.  :)

I can only recommend waiting for the officially release of SEP that includes those changes, though.   Letting betas loose in widespread production environments is best avoided.  RU6 will be comprehensively tested to make sure that the solution works without any knock-on effects.

Thanks and best regards,

Mick

I'll respect Symantecs wishes and keep the files to myself.  Hopefully RU6 wont be too long.

 Even though Dan was the thread holder for this particular issue I went ahead and marked your answer as the right one Andy. My hopes are that Dan will see that this solved your issue and call support to obtain files for his build too. Thanks for keeping us updated throughout this all.

Cheers
Grant

 Hello,

It seems like we are experiencing some of the same issues mentioned in this thread. Our organization is in the process of updating to run SEP 11.0.5002.333 and every device we load it on, can no longer work with GoToAssist.  I have seen from this thread that the solution sees to be two new files rather than excluding the GoToAssist files.

Is this a combined solution of not only using the two new files, but in addition excluding a specific set of files from GoToAssist? When will these new files become available for the rest of us to use?

Thank you for any information you may have on this.

Tom

I have been on the phone for over an hour.  Spoke to three people.  Opened two seperate tickets.  Passed to three different units.  For a problem that is known!  I gave them this thread info.

Can one of the Syumantec engineers contact me directly please?  And yes customer support told me to post on this forum!

Case 411-416387.

Arghhh

FYI-

This works on 64 bit computers, not on 32 bit computers. 

My coworker figured this out...Thanks Aron.

Go to the intrusion prevention policy.  (It does not matter if the policy is applied or not.)  Enable the excluded host file in setting.  Add the cytrix ip ranges for goto assist.  There are 11 ranges.  I can not pass out these ranges, but cytrix customer support will provide them.  This is a temp fix, since they will add servers sooner or later.  Update your policy.

(The cytrix doc is "optimal firewall config".)  Don't add this to the firewall rules in Symantec.....

As to why none of this is logged, I can't say.

Wagner

A big ditto on this one.  On the line for 3.5 hours (3 hours of which was holding) just to be told that the only workaround they would possibly perform would be to downgrade to an older version while waiting for RU6 to be released in a month or two.  Ouch.  I'd really prefer to not take a step back to fix this...

Case: 411416072

I wonder if the same tweak with the policy would work for the Quickbooks problem that everyone is having. Thoughts anyone?

Here is the url from Citrix with their ip ranges

www.citrixonline.com/iprange

Just asking again?  Has Symantec fixed this issue yet?  I have opened a ticket but haven't heard back.

Just a note that SEP 11 RU6, which is the fully-tested build containing the fix for most of these application image base conflicts, is now available via fileconnect.  All SEP 11 customers are encouraged to upgrade to RU6 to take advantage of this and many other improvements and enhancements. 

Thanks and best regards,

Mick

Just an update, RU6 has fixed out issues with GOTO ASSIST.